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Abstract — We derive a lower bound on the secrecy capacity of 
tlie compound wiretap cliannel witli channel state information at 
the transmitter which matches the general upper bound on the 
secrecy capacity of general compound wiretap channels given by 
Liang et al. and thus establishing a full coding theorem in this 
case. We achieve this with a quite strong secrecy criterion and 
with a decoder that is robust against the effect of randomisation 
in the encoding. This relieves us from the need of decoding the 
randomisation parameter which is in general not possible within 
this model. Moreover we prove a lower bound and a multi-letter 
converse to the secrecy capacity of the compound wiretap channel 
without channel state information. 

I. Introduction 

Compound wiretap channels are among the simplest non- 
trivial models incorporating the requirement of security against 
a potential eavesdropper while at the same time the legitimate 
users suffer from channel uncertainty. They may be considered 
therefore as a starting point for theoretical investigation tend- 
ing towards applications, for example, in wireless systems, a 
fact explaining an alive research activity in this area in recent 
years (cf. [1], [2] and references therein). 
In this paper we consider finite families of pairs of channels 
2n = {(Wt, Ff) : i = 1, ... , r}Q with common input alphabet 
and possibly different output alphabets. The legitimate users 
control Wt and the eavesdropper observes the output of Vf . 
We will be dealing with two communication scenarios. In the 
first one only the transmitter is informed about the index t 
(channel state information (CSI) at the transmitter) while in 
the second the legitimate users have no information about that 
index at all (no CSI). This setup is a generalisation of Wyner's 
[3] wiretap channel. 

Our contributions are summarised as follows: In [1] a general 
upper bound on the capacity of compound wiretap channel 
as the minimum secrecy capacity of the involved wiretap 
channels was given. We prove in Section ITlI-B I that the models 
whose secrecy capacity matches this upper bound contain all 
compound wiretap channels with CSI at the transmitter At 
the same time we achieve this bound with a substantially 
stronger security criterion called strong secrecy which has 
been employed akeady in [4], [5], [6], and [7]. Indeed, our 
security proof follows closely that developed in [7] for single 
wiretap channel with classical input and quantum output. In 
order to achieve secrecy we follow the common approach 
according to which randomised encoding is a permissible 

' Along the way we will comment what our results look like when applied to 
widely used class of models of the form 2IT = {(Wt, Vs) ■ t = 1, . . . ,T, s = 
1, . . . , 5} with T S which are special case of the model we are dealing 
with in this paper 



operation. The impact of randomisation at the legitimate 
decoder's site is usually compensated by communicating to 
her/him the outcome of the random experiment performed. 
However , in the case of compound wiretap channel with CSI 
at the transmitter this strategy does not work as is illustrated 
by an example in Section IIII-BI We resolve this difficulty by 
developing a decoding strategy which is independent of the 
particular channel realisation and is insensitive to randomisa- 
tion while decoding just at the optimal secrecy rate for all 
channels {Wt : t = 1, . . . ,T} simultaneously. 
Moreover, a slight modification of our proofs allows us to 
derive a lower bound on the capacity of the compound wiretap 
channel without CSI. Additionally, we give a multi-letter 
converse to the coding theorem. This is content of Section 
IIII-CI Due to space limitation we cannot provide proofs here 
and refer to the online supporting material [8]. 
Our results are easily extended to arbitrary sets (even un- 
countable) of wiretap channels via standard approximation 
techniques [9]. 

II. Compound wiretap channel 
Let A,B,C be finite sets and = {!,..., T} an index 
set. We consider two families of channels Wt : A ^ P(i?jE 
Vt : A ^ V{C), t E 6, which we collectively abbreviate by 
SU and call the compound wiretap channel generated by the 
given families of channels. Here the first family represents the 
communication link to the legitimate receiver while the output 
of the latter is under control of the eavesdropper In the rest 
of the paper expressions like W^®" or V^®" stand for the n-th 
memory less extension of the stochastic matrices Wt, Vt- 
An (n, J„) code for the compound wiretap channel 211 consists 
of a stochastic encoder E : Jn ^ V{A'^) (a stochastic matrix) 
with a message set Jn := {!,..., Jn} and a collection of 
mutually disjoint decoding sets {Dj C -B" : j E J,i}- The 
maximum error probability of a (ri, J„) code C„ is given by 



e(C„) := max max > 
^ ' tee jej^ 



E(x''\3)Wf^{D-Ax^). (1) 



I.e. neither the sender nor the receiver have CSI. 

If CSI is available at the transmitter the probability of error 

in ([U changes to 



ecsi(C„) := 



max max 

tee jeJn 



E 



Et{x^\3)Wf^(p'^Ax''). (2) 



Notice, however, that the decoder appearing in (|2) has to be 
universal, i.e. independent of the channel index t in accordance 

^'P(-B) denotes the set of probability distributions on B 



to the fact that no CSI is available at the receiver. 

We assume throughout the paper that the eavesdropper always 

knows which channel is in use. 

Definition 2.1: A non-negative number R is an achievable 
secrecy rate for 21J with or without CSI respectively if there 
is a sequence (C„)„gN of (n, J„) codes such that 

lim ecsi(C„) = resp. lim e(C„) = 0, 

n— >-oo n— ^oo 

lim inf - log J„ > i? and lim max /(J; Z"^) = 0, (3) 

where J is a uniformly distributed random variable taking 
values in J7n and Z" are the resulting random variables at the 
output of eavesdropper's channel Vj*^". 
The secrecy capacity in either scenario is given by the 
largest achievable secrecy rate and is denoted by C5 (2D) and 

cs,csim- 

Remark. A weaker and widely used security criterion is 
obtained if we replace ^ by lim„_j.oo maxjge '^I{J\ = 0- 
We prefer to follow [4], [6], and [7] and require the validity of 
(|3]l. A nice discussion of several secrecy criteria is contained 
in [2]. 

III. Capacity results 

A. Preliminaries 

In what follows we use the notation as well as some 
properties of typical and conditionally typical sequences from 
[10]. For p G V{A), W : V{B), x" G A", and (5 > we 
denote by T^^g the set of typical sequences and by T^gix^^) 
the set of conditionally typical sequences given x". 
The basic properties of these sets that are needed in the sequel 
are summarised in the following three lemmata. 

Lemma 3.1: Fixing 6 > 0, for every p G V{A) and W : 
A-^V{B) we have 



hold where 



P^'\T;^s) > !-(« + 1)1^12-"=^ (4) 
> 1 - (n+ 1)1-411^12-"^''' (5) 



for all G A" with c = 1/(2 In 2). In particular, there is 
no G N such that for each 6 > and n > uq 



P^"(rp",) > 1-2 



— nc'(5^ 



(6) 

(7) 



holds with c' = |. 

Proof: Standard Bemstein-Sanov trick using the proper- 
ties of types from [10] and Pinsker's inequality. The details 
can be found in [11] and references therein for example. ■ 
Recall that for p e V{A) and W : A ^ V{B) pW G V{B) 
denotes the output distribution generated by p and W and that 
X" G 7;", and G T^Jx^') imply that y" G T^^^^^^^^s- 



Lemma 3.2: Let G 7^"^, then fovV:A^ V{C) 



\'^pV,2\A\s\ 

y"(z"|a;") 



< 
< 



13 for all z"Gr^?5(a;") 



(8) 
(9) 



j3 = 2-"(^(^IP)--^'^(''» 



(10) 
(11) 



with universal fi{5),f2[5) > satisfying lim^-^oo /i('5) = 
= lim^-^cxj .f2{S). 

Proof: Cf. [10]. ■ 
In addition we need a further lemma which will be used 
to determine the rates at which reliable transmission to the 
legitimate receiver is possible. 

Lemma 3.3: Let p,p ^ ^(^) ™d two stochastic matrices 
W,W : A ^ V{B) he given. Further let q,q e V{B) be the 
output distributions, the former generated by p and W and the 
latter by p and W . Fix 5 G (0, ^a\\b\ )• Then for every n G N 

< (" + l)l^ll^l2-"(-^(P'^)-^(*» (12) 
for all i" G and 

9®"(Tv^),5(^")) < + l)l^ll^l2-"(^(P''^)--^'(*» (13) 

for all x" G Tpg holds for a universal f{5) > and 
lim^^o f{S) = 0. ' 

Proof: Cf. [11]. ■ 
The last lemma is a standard result from large deviation theory. 

Lemma 3.4: (Chernoff bounds) Let Zi,...,Z]^ be i.i.d. 
random variables with values in [0, 1] and expectation KZ.i = 
pL, and < e < i. Then it follows that 

Pr I i ^ [(1 ± e)p] I < 2 exp (^-L ■ ^) , 

where [(1 ± e)/Lt] denotes the interval [(1 — e)/i, (1 + e)/Lt]. 



B. CSI at the transmitter 

The main result in this section is the following theorem. 
Theorem 3.5: The secrecy capacity of the compound wire- 
tap channel 20 with CSI at the transmitter is given by 

Cs,cs/ (211) - min max {I{V,Yt) ~ I{V, Zt)). (14) 
tee v^x^{YZ)t 
Notice first that the inequality 

Cs.csim < min max (/(I/, Yt) - I{V, Zt)) 
tee v^x^{YZ)t 

is trivially true since we cannot exceed the secrecy capacity 
of the worst wiretap channel in the family 20. This has been 
already pointed out in [1]. The rest of this section is devoted 
to the proof of the achievability. Proof: We choose 
Pi, . . . ,Pt G V{A) and define new distributions on A" by 



P'ti^n 



(15) 



[ otherwise 
Define then for z" G C" 

QtMn ■■= K"(^"l^") • Ir- ,(.")(^") (16) 



on C". Additionally, we set for z" G C" 



(17) 



Now let S := {z" € C" : e;(z") > eaj where e = 2-"=''' 
(cf. Lemma [TTJ and at is from (fTOl l in Lemma [32] computed 
with respect to and 14- By lemma 3.2 the support of Q'^ 
has cardinality < a^^ since for each G 7^" ^ it holds that 

r^^.,(x") C r;V^^2|^|,, which implies that ^I'^es > 
1 - 2e, if 

et(z") - e;(z") • ls(z") and 

gt,."(2") = gt,..(z")-is(z"). (18) 



Now for each t £ 9 define Jn-Ln,t i-i-d. random variables X^i 
with j € [Jn] :={!,..., Jn} and ? G [L„,t] := {1, • • • ,i«.t} 
each of them distributed according to p[ with 



J _ 2"["""te«(-f(Pt>'^t)--f(Pt!^t))-'^] 



2ri[/(pt,Vt) + i] 



(19) 
(20) 



for T > 0. Moreover we suppose that the random matrices 



{^j*/}je[J„]Je[L„.,] and {^|V}je[j„] je[L„.,] are independent 
for t ^ t' . Now it is obvious from ( flTT i and the definition of 
the set S* that for any G S* et(z") = EtQ^ x<*'(-^") - 
if is the expectation value with respect to the distribution 
p[. For the random variables j3^^Q -^(t)(z") (/?< from dHJ) 
define the event 



z"GC" 



Q,^(.,(z")e [(l±e)et(z")] 



(21) 

and keeping in mind that Ot(z") > eat for all z" e S*. It 
follows that for all j G [J„] and for all t G 

2~n[i{ptyt)+g(S)] ■ 



Pr{(ij(i))'} < 2|C|"exp ^L. 



(22) 



by Lemma 13.41 Lemma 13.21 and our choice e ~2 ""^ ^ with 
g(<5) := /i((5) + ^l*?) + 3c'j2. Making 5 > sufficiently 
small we have for all sufficiently large n G N and all t G 
i„^f2-"[^(P''^')+9('^)l > 2"¥. Thus, for this choice of 5 the 
RHS of (l22l l is double exponential in n uniformly in i G 61 
and can be made smaller than eJ^^ for all j G [J„] and all 
sufficiently large n G N. I.e. 

Pr{(i,W)^}<eJ-^ VtG0. (23) 

Let us turn now to the coding part of the problem. Let G 
be given as in We abbreviate X := {X^^^tee 
for the family of random matrices X'*' = {-^jJ''}je[,/„].;e[L„ t] 
whose components are i.i.d. according to p[. We will show now 
how the rehable transmission of the message j G [J„] can be 
achieved when randomising over the index I G L„,f without 
any attempt to decode the latter at the legitimate receiver's 
site. To this end let us define for each j G [Jn] a random set 

D'M)---[J U 'rw.,s(xil^ 

see fce[L„,s] 



(24) 



and the subordinate random decoder {Dj{X)}j^[j^] C B" is 
given by 

D,{X):=D'^{X)n[ y D'^,{X)y. (25) 

felJ„] 

Consequently we can define the random average probabilities 
of error for a specific channel t E 6 hy 



(t)N 



Now ( |25] l implies for each t E 9 and ^ G [Ln.t] 



(26) 



see k£[L„_s] 

+ E E E wr(7^^Axi:i)\x^) 

/e[j„] see fce[L„,,] (27) 



+ E E E w^rw..(41)i4*^) 

i'e[Jr.] see fee[L„,a] 



By Lemma 13.11 and the independence of all involved random 
variables we obtain 

E;,{Wt^-{{D,{X)r\X^;'^j) 
< (n+ 1)1-411^1 .2-""^' 

+ E E E E^(;)iE;,u)W^rw.,^(41)i4*^ 

/e[,/„] see ke[L„,,] ' 

(28) 

We shall find now for j' j an upper bound on 



J2 p;(x")w^r(r,^.,.(41)l^"' 



< 



E 



^^n,^-;r-.wr{T^.Ax\fl)\xn 

(s)^ 



(29) 



_ qr{T^^,siXrl)) 

By Lemma [TT] and by Lemma [331 for any t,s E 9 we have 



(30) 



pr(rp':j>i-(n+i)i^i.2-"^* 

with a universal f{6) > satisfying lima^o f{S) =0 since 
Xjf \ G 7^" 5 with probability 1. Thus inserting this into (|29] l 
we obtain 

^„ I (31) 



for all s,t € 9, all j' ^ j, and all I e [i„,t],fc G [Ln.s]- 
Now by defining z/„ ((5) := (n + 1)1-^11^1 • 2-"'='^' and ^„(5) := 
I - {n + iV-^l • 2-^"^'' thus for each t e 6, I e [i„.t], and 
j e [J„] dill and dm lead to 



E;,{wrm{x)r\xi',>)) 

< ;/n(c5) 

_^ (n + ^ ^ ^ ^ 2-"(min,£e(/(p»,M's)--r(Ps,V,))-/(«)-5-) 

I- I 1\I^I|S 



< M S) + 



Mn(<5) 
Mn(<5) 



T ■ 2~"2 



(32) 

where we have used d20l i. dT9l l, and we have chosen S > 
small enough to ensure that t — f{6) — j > ^. Defining 

a = a{d,T) := "'"^f'^^^ we can find n{S,T,\A\,\B\) e N 
such that for all n > n{5,T, \ A\, \B\) 

ExiWf"'iiDjiX))''\x'jf)) < T ■ 2-"" (33) 

holds for alH e 6*, Z e [Ln,t], and j G [Jn]- Consequently, for 
any t E 9 we obtain 

ExiX^^Hx)) <T ■2-'"'. (34) 

We define for any i e 6* an event iQ{t) = {Xn\x) < 
\/r2^"t}. Then using the Markov inequality and ( |34] | yields 

Pr{(to(i)r}< Vr2-"t. (35) 

Set i := Pltee H/^o Then with (|23] l, (|35] |, and applying 
the union bound we obtain 

Pr{t''} < ^ ^ Pr{ {ij (t))^} < Te + Ti 2-"t < 7^2 . 2-"^" 
tee j=o 

for a suitable positive constant c" > and all sufficiently large 
n e N. 

Hence, we have shown that for each t E 6 there exist 

realisations {(a;^f )je[J„],;6[L„,t] --t E 9} E l of X. 

We show that the secrecy level is fulfilled uniformly in f e 6* 

for any particular {ix^^i)je[.J„].ielL„ t] • ^ ^ ^} ^ ^ Denoting 
by 1 1 • 1 1 the variational distance we have 

L„ 



Qt{-) 



^7^E|K"(-l4*')"Q,,(;>(-) 



^71, t 



1 = 1 



+ 



+ 



1=1 



Ln,t 



1=1 



< 5e, (36) 



In the first term the functions and Q (*)(•) differ 

if 2" ^ TJ!? si^fi)^ i'^ makes a contribution of e to 
the bound. In the second term Qt and Qt are different for 
z" ^ 5 and because ij{t) and X^z^es ©tl-^") > 1 — 2e imply 
L^J2f=i Ez^esQt.a^'f (^") > 1 - 3e, the second term is 
bounded by 3e. The third term is bounded by e which follows 
directly from (ISTT i. 

For any {(a^jf )je[,/„],iG[L„ t] '■ t E 9} E t with the correspond- 
ing decoding sets {Dj : j E [Jn]} it follows by construction 
that 

^ E 7^ E W^r(^,^l4f)< Vt.2--' (37) 

is fulfilled for all t e 6* with a' > 0, which means that we have 
found a {n, Jn) code with average error probability tending to 
zero for n E N sufficiently large for any channel realisation. 
Now by a standard expurgation scheme we show that this still 
holds for the maximum error probabiUty. We define the set 



1 



Gf.^ijEJn-.— Wr{D''Ml')<V^} (38) 



with T] := -v/T - 2""" and denote its complement as Bt := Cf 
and the union of all complements as B = Utee ^t- Then (|37] | 
and ( |38] | imply that 



77 



3e[J,^] l£[L 



for all t e and by the union bound it follows that \B\ < T ■ 
y/rj- Jn ■ After removing all j E B (which are at most a fraction 

of T32~"^ of Jn) and relabeling we obtain a new {n,Jn) 
code {Ej.Dj)j^^j J without changing the rate. The maximum 
error probability of the new code fulfills for sufficiently large 

nEn 

max max — V W?"(D^Ax^*^) < xi ■ 2-""^. (40) 

On the other hand, if we set V;"(z"|(j,0) — ^"(^"l^*^) 
and further define V;"j(z") = L77 Ef=i' ^"(^"Ki' 0)^ 
V;"(z") = j-J2jli ^t" (^")' we obtain that 

- vn\ < - ©di + \\Qt- vrw < 106, (41) 

for all j E [J]n,t E 9 with e = 2-'""'^ where we have 
used the convexity of the variational distance and (l36l l which 
still applies by our expurgation procedure. For a uniformly 
distributed random variable J E [Jn], we obtain with Lemma 
2.7 of [10] (uniform continuity of the entropy function) 

J„ , 

I(J;Z-) = {HiVn-HiV-^)) (42) 

< -lOelog(lOe) + 10nelog|C| (43) 

uniformly m t E 9 (for lOe < e~^). Hence the strong 
secrecy level of the definition 12.11 holds uniformly in 



t G 9. Using standard arguments (cf. [10] page 409) 
we then have shown the achievability of the secrecy rate 
mintee ma.xy^x^{YZ)t i^iV, Yt) - I{V, Zt)). ■ 
Now with a simple example we will show that indeed identi- 
fying both the message and the randomizing indices at the 
legitimate receiver is not possible for all pairs j e [J„] 
and I £ [Ln^t]- This is in contrast to the case where we 
have only one channel to both the legitimate receiver and 
the eavesdropper (cf. [7], [4]). Therefore let rj e [0, 1] and 

/ 1 — 77 77 \ 

set D„ :— I ' . Further, define the channels to 

\ r] 1-vJ 
the legitimate receiver and to the eavesdropper by Wq = 

0, and 



Moreover, 



1 



D^,r, e [0,i), Vo := DrWo,T e [0,i),T 
Wi DfVo - DfDrWQ,Vi := I ? ?). Let 2U := 



1 ^ 
I I 

{{Wt,Vt) : t = 0,1}. Hence Vb and Wi are degraded 
versions of Wq and /(p, Vi) = 0, for all p e 'P{A). Now 
for every p £ 7^ (A) we can choose r small enough, such that 
/(p, Wo) - Iip,Vo) < I{p,W,). With po - (i, k)^^> 
we have in the case of CSI at the transmitter by the defining 
equations (O and ^ = 2«[^(po>w/o)-^(po^^o))-!^] and 
Ln,o = 2"[^(PO'^o)+i]. But choosing f e (0, 1/2] large enough 
we obtain l/77log( J„L„,o) = ^(Po, Wq) - ^ > /(po, Wi) = 
Ccsi{Wo,Wi}, for all small v > 0. Here, Ccsi{Wa,Wi} 
stands for the capacity of the compound channel without 
secrecy, with CSI at the transmitter. 

Remark. Note that for 2IT := {Wt,14 : t = l,...T,s = 
Ij...^*} with S T and the pair {s,t) known to the 
transmitter prior to transmission nothing new happens. A slight 
modification of the arguments presented above shows that 



Cc.cs/ (2n) =min max {IiV,Yt) - I{V, Zs)). 

{t,s) V^X^iYtZ,) 

C. No CSI 

In this final section we describe briefly the capacity results 
in the case where neither the transmitter nor the receiver have 
access to the channel state. We omit the proofs which can 
be found in the online supporting material [8]. Achievability 
part, for example, is shown by a simple modification of the 
proof presented in Section IIII-BI Nevertheless it should be 
mentioned that the traditional method of proof, i.e. sending 
messages and the randomisation parameters to the legitimate 
receiver, works as well in the present model. 

Theorem 3.6: For any compound wiretap channel W we 
have 

Csm > max (min/(C/,rO - max/((7,Z0), 

where X and YtZt are connected via {Wt, Vt). Consequently, 
by simple blocking argument we obtain 

C5 (2B) > lim - max (mmI(U,Y")~maxI(U,Z")). 
^ ' - n^oo n u^x^Y/^zj} tee ^ ' ^ ' tee ^ ' ^" 



Cs (2IJ) < lim - max (min/([/, r")-max/(C/, Z")). 

n^oo n u^x^Y^^z^ tee tee 

Let us consider now the case W := {Wt, Vs : t = 1, . . .T, s — 
1,...S} with S T and the pair {s,t) unknown to both 
the transmitter and the legitimate receiver. If we additionally 
assume that each Vg is a degraded version of every Wt then the 
upper bound in Theorem 2 of [12] together with the concavity 
of I{X;Yt\Zs) in the input distribution, which holds in the 
degraded case, imply that 

CsfSU) = max (min/(p, Wt) — max/(p, Vg)). 

peV(A) t s 

a result which was obtained in [1] with a weaker notion of 
secrecy. 
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